CVE-2026-108089
7.5HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-497
Impact
Unauthenticated remote attackers can read sensitive system internals, verbose debug logs, and profiling data, and trigger cache operations. They only need network access to the exposed Apache Cocoon diagnostic interface.
Root cause
Diagnostic interfaces fail to enforce access controls, exposing internal system metrics and debug logging to unauthorized callers.
Affected systems
Apache Cocoon: all versions.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
No patch will be released because Apache Cocoon is retired; migrate away from the product, or restrict network access to the instance so only trusted IPs can reach it.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.